{"id":"CVE-2026-79535","title":"mbailey VoiceMode <= 8.10.1 is vulnerable to OS Command Injection","summary":"mbailey VoiceMode <= 8.10.1 is vulnerable to OS Command Injection. The update_config MCP tool (and the \"voicemode config set\" CLI) writes a caller-supplied value into ~/.voicemode/voicemode.env without shell-safe escaping.","severity":"medium","cvss":6.3,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","cwe":["CWE-78"],"published":"2026-09-29","updated":"2026-09-30","sourceUpdated":"2026-09-30T21:17:16.040","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79535","references":[{"url":"https://github.com/mbailey/voicemode/commit/c1cef85333fca497c46a11950911d10123f61e48","label":"cve@mitre.org"},{"url":"https://github.com/mbailey/voicemode/releases/tag/v8.10.2","label":"cve@mitre.org"},{"url":"https://www.traceforce.ai/security-advisories/cve-2026-79535","label":"cve@mitre.org"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-30T19:15:43.158487Z"},"epss":0.00511,"epssPercentile":0.43375,"ingestedAt":"2026-09-29T19:44:04.161Z","slug":"CVE-2026-79535","body":"## Overview\n\nmbailey VoiceMode <= 8.10.1 is vulnerable to OS Command Injection. The update_config MCP tool (and the \"voicemode config set\" CLI) writes a caller-supplied value into ~/.voicemode/voicemode.env without shell-safe escaping.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":34.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":214021,"id":"CVE-2026-79535","ts":1790803610310,"field":"cvss","old":null,"new":"6.3"},{"seq":214020,"id":"CVE-2026-79535","ts":1790803610310,"field":"severity","old":"none","new":"medium"}]}